The Complete Guide to Craft CMS Website Maintenance

Why Craft CMS maintenance matters

A Craft site that nobody maintains keeps working for a while. Then a security release goes unapplied, a plugin stops getting updates, a host retires the PHP version the site runs on, or a form integration fails without an error. Each of those is cheap to handle on a schedule and expensive to handle in a hurry. The checklist below is the schedule.

A Craft CMS maintenance schedule

Essential Craft CMS maintenance tasks

1. Keep Craft CMS core updated

Craft ships two kinds of updates. Regular releases bring bug fixes and new features, and they can wait for your monthly pass. Security releases fix a vulnerability that is now public, so they get applied as soon as they ship. The control panel’s Updates utility marks critical updates, and Craft’s changelog notes which releases contain security fixes.

Run updates on a local or staging copy first, with Composer, then commit the updated composer.lock and deploy it. On the server, php craft up runs any pending migrations and applies project config changes in one step.

Version support matters as much as the monthly pass. Craft 5 needs PHP 8.2 or later and MySQL 8.0.17 or later (or PostgreSQL). Craft 4 reached end of life on April 30, 2026, so a Craft 4 site no longer gets security patches at all. See Craft CMS versions and end-of-life dates for the full support timeline.

Best practice: Review Craft core updates at least monthly, and apply security releases immediately.

2. Update plugins regularly

Plugins are often the weakest link in a Craft site. An outdated plugin can carry a known vulnerability, conflict with a Craft core update, or stop being maintained. Update plugins in the same monthly pass as core, and read each plugin’s changelog for breaking changes.

Licenses matter here too. A Craft or paid plugin license includes a year of updates. When it lapses, the site keeps running, but updates stop installing. Keep the licenses in your own Craft Console account, and renew them before the update window closes.

Best practice: Review and update plugins monthly alongside core, and remove any plugin you’re not actively using. Fewer dependencies is a maintenance strategy in itself.

3. Maintain regular backups

A backup only counts if you have restored it. Craft can make a database backup from the command line with php craft db/backup, and restore one with php craft db/restore. Schedule database backups daily, store them offsite, and back up uploaded assets separately, since they live outside the database.

Once a quarter, restore last night’s backup into staging and confirm the site comes up with current content. Note how long it took. That number is your real recovery time.

4. Monitor uptime and performance

Monitoring tells you about a problem before a customer does. At minimum, a Craft site needs:

• Uptime monitoring that alerts you when the site stops responding
• Error logging so you can see PHP and template errors as they happen
• Queue monitoring so stalled background jobs don’t go unnoticed

The queue deserves its own check. Craft uses it to send form notification emails, resize images, and clear caches. If it only runs when someone visits the site, jobs pile up. Run it from the server with a cron job or a background worker, and set runQueueAutomatically to false. Our guide to fixing a stuck Craft queue walks through the setup.

5. Optimize database performance

Craft keeps a revision every time an entry is saved. On a busy site, or one with imports that save entries on a schedule, revisions can grow into millions of rows and slow down every query. Set the maxRevisions config setting to a sensible limit, and prune old revisions with php craft utils/prune-revisions. Craft’s garbage collection (php craft gc) clears out expired sessions, soft-deleted elements, and other leftovers.

6. Keep integrations alive

Anything your site connects to (a CRM, an email platform, a payment processor) is a moving target. Those APIs change and retire versions on their own schedules, and when a connection breaks it usually fails silently. Nobody gets an error; the leads just stop arriving.

Best practice: Test every integration end to end quarterly, and immediately after any major update on either side.

Project config and staging

Craft stores fields, sections, and settings in project config files that live in your repository. Treat those files as code. Make structural changes on a local or staging copy, commit the project config, and let the deploy apply it. In production, set allowAdminChanges to false so nobody changes the schema on the live site, where it would drift from the repository.

A staging copy that matches production is what makes the monthly update pass safe. Updates, plugin changes, and backup restores all get tested there first.

Security hardening for Craft CMS

Turn on two-step verification

Craft 5 includes two-step verification for control panel logins, with authenticator apps and passkeys. Require it for every admin account. A stolen password is the most common way into any CMS, and a second factor stops most of those attempts.

Limit admin access

Follow the principle of least privilege:

• Give admin rights only to the people who change the site’s structure
• Use Craft’s user groups and permissions for everyone else
• Review user accounts quarterly
• Remove access for former employees immediately

Keep the server current

Security doesn’t stop at Craft. The server’s PHP version, web server, and database all get their own security releases, and an unsupported PHP version is a risk even on an up-to-date Craft install. Check the PHP version once a year against its support dates, and plan the move before your host forces it.

Performance optimization

Enable caching

Craft gives you several layers of caching:

• Template caching with the {% cache %} tag for expensive parts of a page
• Data caching for repeated queries and API calls
• Full-page or CDN caching for pages that are the same for every visitor

After content changes, clear only what needs clearing. A full cache flush on every save makes the site slow right after each edit.

Optimize images

Large images are often the biggest drag on page speed. Use Craft’s image transforms to serve images at the size each layout needs, serve WebP where browsers support it, and lazy-load images below the fold.

Use a content delivery network

A CDN serves your static assets from servers around the world, so visitors far from your server get faster load times.

When to get professional help

Some of this can be handled in-house. Bring in help if you:

• Don’t have time to keep up with the monthly update pass
• Aren’t comfortable working with server configuration
• Need a guaranteed response time when something breaks
• Want to stop being the person who finds out about outages from a customer

A simple test: check whether the last twelve months of updates happened. Intentions don’t patch anything.

What this costs

If you’re weighing doing it yourself against paying somebody, what Craft CMS maintenance costs breaks down the two pricing models and what belongs in a plan at each level.

Want it handled? See our Craft CMS support and maintenance plans, or if your site is already behind, we can take over your Craft site, starting with an audit.